Iptables - disable statefull inspection?

Iptables - disable statefull inspection?

[Jan Kaastrup]

[-- Attachment #1: Type: text/plain, Size: 578 bytes --]

Hi
I am working with IT-security, and we are testing Peoples security.
The problem is, we have an automatic scanner, which sends a lot of
SYN_SENT packets.
I want to disable the connections in ip_conntrack, because it completely
kills the CPU because ip_conntrack reach Maximum connection.
I could use another firewall, but I do really like Iptables.
 
I am very sure there must be a way to disable connection tracking and
still use Iptables for other services?
 
 
Med venlig hilsen / Best Regards
Jan Kaastrup
System Administrator 
jka@protego.dk
Mobil: 29 91 25 15
PROTEGO
 

[-- Attachment #2: Type: text/html, Size: 6044 bytes --]

Re: Iptables - disable statefull inspection?

[Patrick Schaaf]

> I want to disable the connections in ip_conntrack, because it completely
> kills the CPU because ip_conntrack reach Maximum connection.

That's simple: answer 'N' to the relevant kernel questions, then build and
boot that kernel. Without ip_conntrack compiled, it will certainly not
interfere with your testing.

If you already did build ip_conntrack as a module, remove the ip_conntrack.o
file under /lib/modules/`uname -r`, and reboot. The system will then not
be able to load ip_conntrack, and consequently fail loading of all components
which rely on ip_conntrack's presence (nat table, state match).

Easy, isn't it? The hard part comes when you want to load-test some
component (like NAT) which does require ip_conntrack...

best regards
  Patrick